Splunk Search

Can I use a regular expression or wildcard inside charting.fieldColors?

johnraftery
Communicator

Hi

I have a timechart with several lines, and I want to set the colors as in charting.fieldColors. However, the field names are dynamic, so I would need to use a regular expression or wildcard in the key; something like this:

<option name="charting.fieldColors">{ "PREVIEW":0x990000, "TASK_*":0x99CCFF } </option>

This there anything like this currently possible?

Thank you
John

lguinn2
Legend

Maybe you can do it this way. charting.seriesColors assigns the first color in the list to the first field in the results table, the second color to the second field, etc.

 <option name="charting.seriesColors">[0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f]</option>

BTW, my example uses the first 5 default color values.

0 Karma

johnraftery
Communicator

Thanks for the suggesion. Unfortunately this won't solve the problem, because there could be any number of fields matching the "TASK_*" regex. So I would need to have 0x99CCFF in the list 100 times, and even then it might not catch all of them.

0 Karma

lguinn2
Legend

Keep in mind that the timechart command, by default, only shows the "top" 10 fields by default, so it is unlikely that you would need to list 100 fields. And if you are listing 100 fields, how can you read that? Perhaps you should consider some form of grouping prior to charting.

0 Karma

johnraftery
Communicator

If anyone knows of an alternative way of assigning color to fields to achieve this, please let me know.

0 Karma

lguinn2
Legend

I don't think so, but try it and see if it works... and let us know!

0 Karma

johnraftery
Communicator

I haven't been successful so far.

0 Karma

jkat54
SplunkTrust
SplunkTrust

I'd try some quoting & escape character to see, but I believe lguinn has the correct answer.

"Task*"
"Task\.*"
"Task%"
'"Task*"'   
0 Karma

johnraftery
Communicator

Thanks...no luck unfortunately.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...